Managing the Program Structure GSLC Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Why is it important to establish reporting mechanisms for a security program?

   • ATo keep leadership informed of security status and enable informed decision-making
   • BTo automate all security controls
   • CTo replace the need for security policies
   • DTo ensure that all employees read security reports
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which of the following is an example of a continuous improvement mechanism for a security program?

   • AConducting an annual program review and updating the roadmap
   • BDisabling feedback channels to reduce noise
   • CKeeping policies unchanged to avoid confusion
   • DPerforming a one-time risk assessment at program launch
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A global company is aligning its security program with its corporate governance framework, which emphasizes decentralized decision-making. How should the security program structure reflect this governance style?

   • AAllow each region to develop its own security policies without any global oversight.
   • BEstablish regional security officers who have the authority to make security decisions within their region, while adhering to global minimum standards.
   • CCentralize all security decisions at the global headquarters to ensure uniformity.
   • DCreate a security committee that includes representatives from each region but has no decision-making authority.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A security program has been stable for several years, but a recent post-implementation review revealed that the program is not adapting to new cloud-based business processes. The review also found that the existing KPIs do not measure cloud security effectiveness. The CISO must implement a continuous improvement mechanism. Which action is most effective?

   • AAdopt a new security framework that is specifically designed for cloud environments.
   • BWait for the next major security incident to trigger a review of the program.
   • CSchedule an annual review of the program structure and KPIs to ensure they remain relevant.
   • DEstablish a quarterly continuous improvement cycle that reviews KPIs, incorporates feedback from stakeholders, and updates the program structure as needed.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A financial services firm is designing its security program structure and must comply with a new data protection regulation that requires specific reporting and response times for data breaches. How should the firm incorporate this requirement into the program structure?

   • AAdd the requirement to the risk register and review it annually to ensure compliance.
   • BOutsource all incident response to a third-party provider to ensure compliance without internal resource allocation.
   • CCreate a dedicated incident response team with defined roles and a documented process that meets the regulatory reporting timelines.
   • DWait until the regulation takes effect before making any structural changes.
   Reveal Solution Discussion Select an answer first